How can I block specific users from accessing Open OnDemand

[Jimmy888-333]

Hi Support,

Our Open OnDemand version is 3.0.1 and uses an LDAP server for user authentication. We would like to know if it is possible to specify that only certain users can access Open OnDemand. Thanks

[travert (Travis Ravert)]

Sorry, I don’t quite understand this question. If you have authentication setup then users not in your auth won’t be able to login…

I think I’m not understanding the question maybe.

[novosirj (Ryan Novosielski)]

We actually have the same question at our site, and in our use case, it’s suspending individual users for abuse. For SSH access to our cluster, we use /etc/security/access.conf, but this doesn’t appear to affect OOD if set on the OOD server.

[jeff.ohrstrom]

You (both) need to set the users’ shell to something like /disabled or /bin/false or similar and use the nginx configuration disabled_shell to the shell you set. We’ll recognize that the users’ shell is the disabled shell and won’t boot the PUN.

Here’s a similar topic.

/bin/true account access to OnDemand

OK, so if we set it to say “/bin/bash”, the user will be denied accessing bash? How would that affect the nginx? We already disable the shells by setting the user’s shell to “/bin/true”, our goal is to make nginx aware of that and not start even if the user authenticates with the CAS.